305 matches found
osi.ig
Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...
CVE-2026-51564
CVE-2026-51564 Security Advisory for CVE-2026-51564 Description An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request. Affected Components: App/Route.php, publichtml/index.php Mitigation At the time of...
EUVD-2026-93507
Payload external upload trust validation issue...
CVE-2026-105861
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...
CVE-2026-105861
The headless content management system Payload is vulnerable in versions after 3.0.0 and before 3.90.0 . The flaw resides in the authenticated external URL-based upload retrieval feature, where the system fails to verify the trustworthiness of a redirected destination. This origin validation erro...
CVE-2026-105861 Payload external upload trust validation issue
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...
CVE-2026-105861 Payload external upload trust validation issue
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...
CVE-2026-105861: Exposure of Sensitive Information to an Unauthorized Actor
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...
PT-2026-106794
Name of the Vulnerable Software and Affected Versions Payload versions 3.0.1 through 3.89.9 Description Authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that has not been verified as trusted. This behavior may expose a valid session to ...
Astra Linux – Vulnerability in Firefox and Thunderbird
A website could have obscured the fullscreen notification by using a URL that was processed by an external program, such as a mailto URL. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbi...
CLEANSTART-2024-OJ63880 Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL
Security vulnerability affects the drupal7 package. Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL...
Astra Linux – Vulnerability in Thunderbird, Firefox
A website could have obscured the full-screen notification by using a URL that was processed by an external program, such as a mailto URL. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox 116, Firefox ESR 115.2, and Thunderbi...
CVE-2026-86853 Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...
CVE-2026-86853 Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...
EUVD-2026-72875
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...
CVE-2026-86853: User Interface (UI) Misrepresentation of Critical Information
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...
Security Vulnerabilities fixed in Firefox for iOS 155.1 — Mozilla
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed...
MAL-2026-15545 Malicious code in ux-metrics-client-interaction-subscriber (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...
MAL-2026-15498 Malicious code in aws-blog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b036991e88a4be9813e89ba9861b39ae37fbd9201d1bd017f81c8b33d5f5e44b package.json declares a dependency whose key equals the package's own name aws-blog with a value of https://repo.securityctrl.com/aws-blog instead of...
